What is AI governance?
By Joey van Vliet, founderUpdated
In short
AI governance is the set of roles, rules and controls an organisation uses to decide how it uses AI. It sets out who decides on new AI, which AI is running, what risk comes with it, who checks the output and what gets recorded. It isn’t about the technology itself but about control: knowing what’s happening and being able to show it.
What does it include?
For a small or medium-sized business, AI governance comes down to six building blocks:
- Ownership: one person with a name and a mandate, and an owner for each use in the department that relies on its output.
- A register: a list of all AI in use, with vendor, purpose, data and owner.
- Risk classification: for each use, whether personal data goes in and whether the output leads to a decision about someone.
- Logging: recording per action what happened, based on which input, and who approved it.
- Policy: the house rules on approved tools, data and human oversight.
- [AI literacy](/begrippen/ai-geletterdheid): making sure people understand what the AI does and where it can go wrong.
Why it matters
AI arrives uninvited, through new features in software you already use. And AI is moving from answering to acting: an AI agent takes steps in your systems by itself. Without agreements, nobody knows any more what’s running, who switched it on and what it’s allowed to do.
On top of that come questions from outside. Customers and contracting authorities ask in supplier questionnaires how your use of AI is managed. And the EU AI Act asks users of AI to take measures, including for AI literacy. High-risk AI comes with heavier requirements, such as human oversight and logging. Governance is how you keep track of that and show it.
An example
As an illustration: an installation company finds that three teams each use a different AI tool for quote texts, two of them on personal accounts. Management appoints one owner, the tools go into a register and the company chooses one business account. It’s agreed that prices always come from the quoting system, never from the AI. From now on, a new tool goes past the owner first.
A common misconception
That AI governance is the same as an AI policy. The policy is the document with the house rules. Governance is how you make sure those rules are followed, updated and checked: with an owner, a register and a fixed moment to review it all. A policy without an owner ends up in a drawer.
A second misconception: that it’s only for large companies. A committee and a certificate are indeed too much for most SMEs. An owner, a list and a few clear rules aren’t.
Why it matters in practice
Start with an owner and the register. Ask each team which AI tools they use, including free accounts, and put everything on one list. That list is almost always longer than expected. Then classify each use by risk and set out the house rules in an AI policy. The more AI does by itself, the more the rules need to live in the software: its own account per agent, permissions per action and an append-only log. The six building blocks are set out in AI governance for SMEs.
This is a general explanation, not legal advice. Sources: Regulation (EU) 2024/1689 and Regulation (EU) 2026/1744 on EUR-Lex.
Frequently asked questions
Is AI governance mandatory?
The term itself isn’t a legal obligation. But the EU AI Act asks users of AI to take measures for AI literacy, and high-risk AI comes with heavier requirements. The GDPR applies as soon as personal data goes into an AI tool. Governance is how you keep track of those obligations and show you meet them.
What’s the difference between AI governance and an AI policy?
The AI policy is the document with the house rules. AI governance is how you make sure those rules are followed, updated and checked, with an owner, a register of AI use and a fixed moment to review it all.
Who is responsible for AI governance?
Senior management remains ultimately responsible. In practice you appoint one owner with a name and a mandate, who keeps the register and assesses new tools, and give each use an owner in the department that relies on its output.
